Securely Managing External API Keys on the Server-Side

// server.js (Node.js Express example)
const express = require("express");
const fetch = require("node-fetch"); // Or use native fetch in Node.js 18+
require("dotenv").config(); // Loads .env file variables into process.env

const app = express();
const PORT = process.env.PORT || 3000;

// IMPORTANT: Never hardcode API keys directly in your code.
// Use environment variables (e.g., by creating a .env file: EXTERNAL_API_KEY=your_secret_key)
const EXTERNAL_API_KEY = process.env.EXTERNAL_API_KEY;
const EXTERNAL_API_URL = "https://api.external-service.com/data"; // Replace with actual API URL

if (!EXTERNAL_API_KEY) {
  console.error("EXTERNAL_API_KEY is not defined in environment variables. Please set it.");
  process.exit(1); // Exit if critical key is missing
}

app.get("/api/fetch-external-data", async (req, res) => {
  try {
    // Construct headers with the API key
    const headers = {
      "Content-Type": "application/json",
      "Authorization": `Bearer ${EXTERNAL_API_KEY}`, // Common pattern, adjust as per API docs
      // Other headers like "x-api-key" may be used by different APIs
    };

    const response = await fetch(EXTERNAL_API_URL, { headers });

    if (!response.ok) {
      throw new Error(`External API error: ${response.status} ${response.statusText}`);
    }

    const data = await response.json();
    res.json(data); // Send external data back to client (or process it further)

  } catch (error) {
    console.error("Error fetching external data:", error.message);
    res.status(500).json({ error: "Failed to fetch data from external service." });
  }
});

app.listen(PORT, () => {
  console.log(`Server running on http://localhost:${PORT}`);
});

// To run this:
// 1. npm install express dotenv node-fetch
// 2. Create a .env file in the root with: EXTERNAL_API_KEY=your_actual_secret_key
// 3. node server.js
// 4. Access: http://localhost:3000/api/fetch-external-data